mirror of
https://codeberg.org/reverse-skill-lab/apk-reverse
synced 2026-11-15 21:04:20 +08:00
dabao1955
2f6b26f4dd
The milksu integration was audited a second time, independently: four read-only passes, each taking a group of the source articles and verifying the coverage claims against the whole repository (references and scripts), with instructions to contradict rather than confirm. Their findings corrected the prior pass in both directions and drove every change here. The audit's most useful correction was against the integration itself: the ActivityThread.currentApplication() Context idiom had been reported missing while it ships working in scripts/rpc_template.js and scripts/sig_probe.py -- the pass had audited only references/. The fix is a cross-link, not absorption. Two more claims were narrowed (advanced-unpacking covers the classloader lab, not the dynamic-proxy lab; readelf coverage lives in toolchain.md, not the files first proposed), one attribution was repaired, and one provenance note was added: the absorbed Binder hook is not the article's script -- the source hooks Binder.transact with server-side getCallingUid() semantics inside; the form kept here is corrected and now says so. What the audit found genuinely absent, now integrated (all labelled unverified or inferred with the retrieval date at the point of use): - system-ipc-audit.md: generated-proxy hooking (decoded arguments beside the raw transact), the debugfs binder node/ref view for "why does my hook never fire", two new Intent signature rows (intent-scheme handoff, ClipData URI grants), am start/broadcast action-data-extras driving forms, the Intent monitor with live nested-Intent detection, the deep-link getData triage, three config rows the earlier table silently truncated (JavaScript, DOM storage, mixed content), the loadUrl dynamic hook, the logcat Console fallback channel, the four-surface static WebView pass, and the attestation KeyDescription/OID reading with the teeEnforced extraction discriminator. - lsposed-and-modules.md: LSPatch as the fourth route -- module-class authoring, repack-class delivery, runs on unrooted phones; plus existence proofs for the resource-hook and constructor/field/hook-all API surface. - dynamic-frida.md: the scripts' own Context idiom cross-linked with the Android 9+ hidden-API reflection boundary; dynamic proxy as an interception primitive; the LD_PRELOAD-closed-on-Android row in the non-live table. - toolchain.md: the lldb-server remote recipe, with the attach-is-detection pointer. - java2c-and-jni-sinking.md: the __<proto> mangling decode route step 2 silently depended on. - advanced-unpacking.md: the local-reference cap hazard on active-invocation loops. - native-and-so.md: the JNI width/type map beside the vtable shape. - recon.md: the MODE_WORLD_READABLE/WRITABLE row the earlier table dropped. Gates re-run: routing coherent, 409 section references with zero dangling, repo clean, pytest 751 passed / 194 skipped / 25 xfailed.